FREE SHIPPING ON ORDERS OVER $100 | JOIN THE MOVEMENT
Theory Seven

Privacy Policy

Effective Date: September 15, 2026

Section 1: Information We Collect

  • Account Profile Data: Name, email address, date of birth, age, gender, timezone, height, and profile avatar.
  • Health & Fitness Telemetry Data: Activity metrics (steps, calories, distance, active minutes), biometric vitals (heart rate, HRV SDNN, VO2 Max, blood pressure, SpO2, blood glucose, weight), and sleep.
  • Data Sources: Synced automatically via Apple HealthKit, Google Health Connect, or entered manually by you.
  • Device Data: Hardware model, OS version, app version, FCM push tokens, and IP address.

Section 2: Apple HealthKit & Google Health Connect Privacy Guarantee

Strict Non-Disclosure Guarantee: Health and biometric telemetry data collected from Apple HealthKit or Google Health Connect will NEVER be sold, rented, leased, or shared with third-party advertisers, data brokers, or marketing networks. We use HealthKit and Health Connect data solely to provide health and fitness tracking features directly inside the Theory Seven application.

Section 3: How We Use Your Information

We process your data to generate personalized AI workout plans, track fitness progress, operate community circles, deliver push notifications, and enforce community content safety guidelines.

Section 4: Legal Bases & California Privacy Rights (GDPR & CCPA)

1. GDPR Compliance (EU/UK Users): We process data under Performance of Contract, Explicit Consent, and Legitimate Interests. Users have the right to Access, Rectify, Delete, and Export data.

2. CCPA/CPRA Rights (California Residents): California residents have the Right to Know, Delete, Correct, and Opt-Out. Theory Seven does not sell or share your personal or health information.

Section 5: Third-Party Service Providers

We share data only with essential infrastructure service providers: Supabase (database & auth), Shopify (store purchases), and Firebase Cloud Messaging (push notifications).

Section 6: Data Security and 30-Day Permanent Account Deletion

1. Encryption: All communication is encrypted in transit via TLS 1.3 and at rest via AES-256 with database Row Level Security (RLS).

2. Account Deletion Rights: You can request full account deletion inside app settings or by emailing info@theorysevenbrand.com. All personal profile information, health logs, and device tokens are permanently purged within 30 days.